Skip to content
OpenAdvisories

Vendor

Apache Software Foundation

2,970 known vulnerabilities.

Products

Apache Airflow 169 Apache Tomcat 141 Apache HTTP Server 139 Apache Traffic Server 111 Apache OFBiz 97 Apache Camel 97 Apache Thrift 90 Apache Superset 65 Apache CXF 56 Apache CloudStack 51 Apache NiFi 47 Apache DolphinScheduler 46 Apache Syncope 45 Apache InLong 41 Apache bRPC 41 Apache Kylin 40 Apache ActiveMQ 40 Apache Wicket 40 Apache OpenOffice 39 Apache TomEE 39 Apache Answer 37 Apache APISIX 34 Apache Struts 33 Apache Pulsar 30 Apache IoTDB 28 Apache Zeppelin 25 Apache Solr 24 Apache Roller 24 Apache OpenMeetings 23 Apache Ranger 23 Apache Kafka 23 Apache Fineract 22 Apache JSPWiki 22 Apache ActiveMQ All 20 Apache ZooKeeper 19 Apache Allura 19 Apache Qpid Broker-J 19 Apache Geode 18 Apache Hadoop 18 Apache Hive 18
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-46584 Public exploit

    Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

    Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smt…

    Apache Software Foundation Apache Camel Mail org.apache.camel:camel-mail Maven
  • Low 3.5
    CVE-2025-26865 Public exploit

    Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.   It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which …

    Apache Software Foundation Apache OFBiz
  • Low 2.1
    CVE-2024-56512 Public exploit

    Apache NiFi: Missing Complete Authorization for Parameter and Service References

    Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to …

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven
  • Low 2.9
    CVE-2024-22371 Public exploit

    Apache Camel issue on ExchangeCreatedEvent

    Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, …

    Apache Software Foundation Apache Camel org.apache.camel:camel-core Maven
  • Low 3.8
    CVE-2023-39265 Public exploit EPSS 86%

    Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

    Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Ad…

    Apache Software Foundation Apache Superset apache-superset PyPI